# config.php holds database credentials — block direct access even though
# it doesn't echo anything if executed directly (defense in depth).
<FilesMatch "^config\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Deny from all
    </IfModule>
</FilesMatch>
